soc-ai 1.6.0¶

Summary¶

soc-ai 1.6.0 records each grid gap and shows it on the Dashboard, Alerts, Hunts and host pages. The sweeps do not score the hours of a gap, and the baselines do not learn an outage as zero. The operator can act on waiting actions from the Investigations list and on many leads with one press. One rule decides whether a write to Security Onion can run, and each refusal states its reason. The full list is in CHANGELOG.md under 1.6.0.

Grid gaps¶

The sensor of the attack range was down from 2026-10-15 to 2026-10-19. A dogfood on the range and on a fresh install found 141 defects, and many came from that outage. Before this release, a baseline learned an outage as a count of zero. The Alerts page said "The grid is quiet" over the outage.

A grid gap is a span of time when grid data is missing. soc-ai opens a gap when the grid refuses the connection or does not answer for 3 minutes. The first good answer closes the gap. The ledger is in the store. An open gap therefore survives a restart. Migration 0064 adds the grid_gaps table.

The sweep also records a gap when most hosts of a plane send no documents in the same hours. One quiet host among busy hosts still gets its departure. The sweep does not score the hours of a gap or the settle margin after it. grid_gap_settle_minutes sets the margin, and the default is 60. A profile stores a gap hour as missing. A hit inside a gap does not count toward the daily hit limit of its analytic.

The Dashboard, Alerts, Hunts and the host page show a strip for each gap in the page window. A closed gap stays in the bell for 24 hours. The general chat and a hunt get one fact line for each gap in their window. GET /api/v1/grid/gaps returns the ledger.

The operator can record a gap that soc-ai did not see. Use soc-ai grid-gaps add:

soc-ai grid-gaps add --start 2026-10-15T13:36:00Z --end 2026-10-19T09:00:00Z \
  --detail "The sensor VM was down"

An admin can also use POST /api/v1/grid/gaps. soc-ai grid-gaps list prints the ledger.

The strip of a closed gap that wrote hits offers "Review N hits in this gap". soc-ai selects a hit when its event window lies inside the gap and the hit is not a spike. The drawer states the reason under each hit that soc-ai does not select. The operator can change each selection. One confirm marks the selected hits benign with the reason grid_gap. The lead page then leaves the benign observations out of its weight.

The hold card of an analytic counts the hits inside a gap among the hits that broke its limit. When the gap hits alone broke the limit, the card offers Return to live.

Verdicts and writes¶

The action card, the Investigations row, the needs-you count and the execute route read one action rule. Each refusal states its own reason. A write is off in these cases:

a backtest replay, and a superseded investigation
the investigation of a promoted finding or lead
an anchor document that is not a Security Onion alert
an investigation with no alert, and a comment with no case
a write that disagrees with the analyst verdict on the alert
the demo

A promoted finding or lead uses one document as its anchor. A write on that document is now off only when the document is not a Security Onion alert. The operator can therefore escalate a Security Onion alert that a lead cites, from the investigation of the alert. soc-ai checks the anchor documents against the alert feed with one grid search for each page. When the grid does not answer, soc-ai refuses the write and states the reason.

The execute route refuses a write against the analyst verdict with 409 analyst_verdict. Auto-acknowledge never acts on an alert that carries an analyst verdict other than false positive. The guard covers a re-run and the cluster fan-out. Re-run, Deep re-run and Request more info ask first when an analyst verdict stands on any investigation of the alert. Bulk Re-investigate skips such an alert.

The Acknowledge button and the escalate confirm state what one press writes. A second press names what is already done. The escalate card names and links each case that the alert is already on. A press then opens no second case and records the action as done.

Operator workflow¶

The Investigations list at ?actions=pending shows each waiting action on its row. The row button names the write, and Dismiss is next to it. Select rows and press Dismiss actions to dismiss their waiting actions with one confirm. The result line names each row and offers Undo.

The needs-you count holds only the actions that a person can execute. The count, the badges and the bell leave out the rest. The investigation page keeps each such action with its reason. On the attack range, 8 of the 9 counted actions were on promoted findings.

An Alerts group names the other groups on its network flow. A sibling group has an alert with the same community id within 1 hour, or an alert between the same two hosts within 5 minutes. The chip warns when the verdicts are opposite. Show in Alerts opens the row of each sibling. The sibling read costs at most two searches. The new route is GET /api/v1/alerts/siblings.

An escalation claim with no case id blocks each later escalation of its alert. "Check Security Onion now" on the Status page compares one claim with Security Onion. A case link settles the claim, and the result links the case. The check writes nothing to Security Onion. The route is POST /api/v1/escalations/check.

A running backtest has a Cancel control. The run stops after the alert in flight and keeps the results that it finished. POST /api/v1/backtest also takes alert_ids, a list of 1 to 200 alert ids.

Hunts and leads¶

The operator can select leads on the Hunts page. One press dismisses, reopens or hunts the selection. The confirm states the count and the skips. A bulk hunt starts at most 3 hunts. Undo stays for 2 minutes.

The Analytics tab and the Status page show a failed or blind sweep. Before, they showed a green "live" over failed sweeps. A hunt opens no investigation for an observation finding. The hunt outcome counts the threat findings over all findings. A lead that soc-ai closed on the verdicts of its hunt says so.

Hosts¶

The entity page reads every key of a machine. An address and a name of one machine show the same counts. The host page lists the investigations of the machine. The Users card reads Windows logons.

The Connections rate divides by the window hours that hold records, and it leaves out the hours of a grid gap. Before, the 7d rate divided by 192 hours on a 168-hour window. Each relative age follows one rule. Before, the host header read "30h ago" where the lists read "1d ago".

Settings and Status¶

An admin cannot reset their own password in Settings. soc-ai users reset-password <name> recovers a locked-out admin. soc-ai users list prints the accounts. Every page shows a banner while the account uses the generated password. The sign-in page states the transport in use.

Each setting shows its source: DEFAULT, ENV or DB. "Use the default" removes a database override. The "Danger Zone" section is now "Connections". It shows the current values and tests an edited value. An API token has a name, and Revoke asks first.

The Status page shows the dependencies and each scheduled job. A model check that meets only transport errors reads "could not measure" and raises no alarm. soc-ai doctor adds the rows admin password and backups. An empty alerts feed is WARN.

Console¶

The Dashboard, Hunts, Investigations and host pages keep their window and filters in the URL. A custom window means the same hours on every page. A chat turn that times out after its tools returned writes a partial answer. Chat answers link addresses, leads and investigations.

Text¶

The console, the operator strings of the backend, the docs and the in-app guide follow ASD-STE100 Simplified Technical English. The timeline shows no prompt text and no internal labels.

Investigator strategy¶

The code of the swarm triage experiment ships in 1.6.0. It changes nothing by default. investigator_strategy defaults to single, and the investigation loop runs as in 1.5.3. The Settings page does not show the setting. It is an experiment setting. In the experiment, no other strategy improved on single within the cost limit. The cost limit is two times the tokens of single.

Two fixes apply to the self-consistency vote when verdict_consistency_samples is above 1. The default is 1, and the vote is then off. Each extra sample now emits a usage event. A run that reaches its tool budget now votes with a partial verdict.

Security¶

The lock moves aiohttp to 3.14.5 and certifi to 2026.10.19. The new versions close four CVEs in aiohttp 3.14.3 and one advisory in certifi 2026.4.22.

Upgrade¶

Back up the store with soc-ai backup. Migrations run at start. soc-ai has no schema downgrade.
Docker: run SOC_AI_IMAGE_TAG=1.6.0 docker compose pull soc-ai && docker compose up -d.
Source install: run uv sync and restart soc-ai. Add --extra ml if you use the estate model. The systemd unit does not change.
Migration 0064 runs at the first start. It adds the grid_gaps table.
Keep the backup from step 1. An older image refuses a store at a newer migration head. A rollback to 1.5.3 therefore restores that backup. See Rollback.
Run soc-ai doctor. The admin password row reads WARN while the admin uses the generated password. The backups row reads WARN when <data dir>/backups holds no soc-ai-backup-*.tar.gz archive from the last 48 hours.
No setting needs a change. investigator_strategy stays single.

Known limits¶

The probe opens a gap only when the grid refuses the connection or does not answer. A slow answer or a partial read opens no gap. Record such a span with soc-ai grid-gaps add.
soc-ai grid-gaps add refuses a span over 30 days, and a start or an end in the future.
The benign marks of a gap review have no undo.
The same-flow read can be partial. The count then reads "at least".
The experiment ran on synthetic scenarios only. It has not replayed closed production alerts.
soc-ai has no campaign object yet, and no test has checked the lead thresholds against a miss. Release 1.7 holds both items.